CVE WatchNov 10, 2026

CVE-2026-105507

An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading

CVSS

7.8

High

EPSS

—

KEV

—

Exploit Today

0-100

Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-122

EPSS · 30d

Not enough EPSS history yet.

Technical description

An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation.

Official references

msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105507

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-970156.8 MED

—

——0Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.3h CVE-2026-969937.5 HIG

—

——0Release of invalid pointer or reference in Windows Performance Monitor allows an unauthorized attacker to execute code over a network.3h CVE-2026-961847.8 HIG

—

——0Heap-based buffer overflow in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.3h CVE-2026-961648.8 HIG

—

——0Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.3h CVE-2026-961579.8 CRI

—

——0Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.2h CVE-2026-961537.0 HIG

—

——0Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.3h